CVE-2025-11952
Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Analyzed - cve-coordination@incibe.es
- Published
- 2025-10-22
- Last modified
- 2026-10-08
- Weaknesses
- CWE-79
Affected products
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-oct8ne-chatbot
